
"""
in
  Ether / ARP who has 10.2.100.254 says 10.2.100.98
  hsaddr:  00:15:af:cd:2c:2b  , vendor:  AzureWave Technologies, Inc.
  [mensaje] de: 10.2.100.98 a: 10.2.100.254

  Ether / ARP is at 00:1b:21:7f:6c:fd says 10.2.100.254 / Padding
  hsaddr:  00:1b:21:7f:6c:fd  , vendor:  Intel Corporate
  [mensaje] de: 10.2.100.254 a: 10.2.100.98
out
  10.2.100.98 10.2.100.254 ip 10.2.100.254 -- 00:15:af:cd:2c:2b AzureWave
  
  10.2.100.254 10.2.100.98 mac 00:1b:21:7f:6c:fd -- 00:1b:21:7f:6c:fd Intel
"""
def first_parsing(inf, outf):
  # struc {ip_source, ip_dest, t_msg, msg, dest_msg, mac, vendor}
  
  # files
  infile = open(inf)
  outfile = open(outf, 'w')

  # header
  outfile.write('ip_source ip_dest t_msg msg dest_msg mac vendor\n')

  # loop
  for l in infile:
    line = l.split()
    if 'Ether' in line:
      if 'who has' in l:
	t_msg = 'ip'
      elif 'is at' in l:
	t_msg = 'mac'
      else:
	t_msg = '-error-'
      msg = line[5]
      dest_msg = '--'
    
    if 'hsaddr:' in line:
      mac = line[1]
      vendor = line[4]
    
    if '[mensaje]' in line:
      ip_source = line[2]
      ip_dest = line[4]
      dato = '%s %s %s %s %s %s %s\n' % (ip_source, ip_dest, t_msg, msg, dest_msg, mac, vendor)
      outfile.write(dato)

  # close
  infile.close()
  outfile.close()

"""
in
  10.2.100.98 10.2.100.254 ip 10.2.100.254 -- 00:15:af:cd:2c:2b AzureWave
out
  10.2.100.98 frec %
"""
def ip_parsing(inf, outf, pos):
  # files
  infile = open(inf)
  outfile = open(outf, 'w')

  # header
  outfile.write('ip frec porcen\n')
  
  # loop to count
  ips = {}
  total = 0
  for l in infile:
    line = l.split()
    ip = line[pos]
    total += 1
    if ip not in ips:
      ips[ip] = 1
    else:
      ips[ip] += 1
  
  # restar cabecera
  total -= 1.0

  # sort by cant
  import operator
  iplist = sorted(ips.iteritems(), key = operator.itemgetter(1), reverse=True)
  
  ip_tops = iplist[0:10]
  ip_rest = iplist[10:]
  acum = 0
  for i, c in ip_rest:
    acum += c
  # restar cabecera
  acum -= 1
  
  otros = ('otros', acum, round(acum/total*100, 2))
  
  # new list
  ips = []
  for ip, cant in ip_tops:
    temp = (ip, cant, round(cant/total*100, 2))
    ips.append(temp)
  ips = ips + [otros]
  
  # dump into outfile
  for i, c, p in ips:
    outfile.write('%s %s %s\n' % (i, str(c), (str(p)+'%')))

  # close
  infile.close()
  outfile.close()

"""
in
  10.2.100.98 10.2.100.254 ip 10.2.100.254 -- 00:15:af:cd:2c:2b AzureWave
out
  AzureWave frec %
"""
def vendor_parsing(inf, outf):
  # files
  infile = open(inf)
  outfile = open(outf, 'w')
  pos = 6

  # header
  outfile.write('vendor frec porcen\n')
  
  # loop to count
  vendors = {}
  total = 0
  for l in infile:
    line = l.split()
    vendor = line[pos]
    total += 1
    if vendor not in vendors:
      vendors[vendor] = 1
    else:
      vendors[vendor] += 1
  
  # restar cabecera
  total -= 1.0

  # sort by cant
  import operator
  venlist = sorted(vendors.iteritems(), key = operator.itemgetter(1), reverse=True)
  
  # tops + resto => otros
  tops = venlist[0:10]
  rest = venlist[10:]
  acum = 0
  for i, c in rest:
    acum += c
  # restar cabecera
  acum -= 1
  
  otros = ('otros', acum, round(acum/total*100, 2))
  
  # new list
  vendors = []
  for name, cant in tops:
    temp = (name, cant, round(cant/total*100, 2))
    vendors.append(temp)
  vendors = vendors + [otros]
  
  # dump into outfile
  for v, c, p in vendors:
    outfile.write('%s %s %s\n' % (v, str(c), (str(p)+'%')))

  # close
  infile.close()
  outfile.close()

###

#~ first_parsing('us.txt', 'us.0')
#~ ip_parsing('us.0', 'us.ipsrc.0', 0)
#~ ip_parsing('us.0', 'us.ipdst.0', 1)
vendor_parsing('us.0', 'us.vendors.0')

  
